Computers and laptops

A computer does not only keep the files its user chose to save. It also, and above all, keeps a record of what was done with those files — and that is almost always where the answer to a legal question is found.

What a machine records without being asked

The contents of documents are the least interesting part of an examination. A document proves what it says; it rarely proves who put it there, when, or whether it previously said something else. Those questions are answered by records the operating system produces by itself, for operational reasons, and which no user thinks to delete because they do not know they exist:

• event logs, noting start-ups, shutdowns, successful and failed logons, software installations and network connections;
• execution traces, which retain when an executable was launched and how many times, even after it has been uninstalled;
• recent-item and shortcut records, which outlive the original file and preserve its name, path and size;
• records of attached devices, which allow one to say which USB stick or external disk was inserted, with which serial number, and at what moment;
• automatic system snapshots, which frequently hold an earlier version of a file that has since been altered or removed.

It is the intersection of these sources that produces a sound finding. An isolated trace says little and invites alternative explanations; four independent traces converging on the same minute are a different matter.

The questions a computer can genuinely be asked

The copy comes before the analysis

One never works on the computer itself. A full copy of the medium is produced, taken while writing to the original is physically prevented, and from that point every activity happens on the copy. A hash function is applied to that copy, returning a value capable of revealing any later difference, down to a single bit: this is what makes it possible, months afterwards, to show that the material examined is still the material acquired.

This step is not a bureaucratic formality. It is the point at which most digital evidence is irreversibly damaged, and almost always in good faith: simply switching the computer on to «have a quick look» causes the system to write to the disk tens of thousands of times, update last-access dates, and fill with new data precisely the free space in which deleted files would have survived. Further reading: forensic imaging and hashing, what they actually guarantee →

Running machine, powered-down machine

The difference matters more than it appears, and it dictates the order of operations.

A powered-down computer is a simple problem: remove the drive, or copy it through an adapter that blocks writing, and proceed.

A running computer poses a choice that allows no second thoughts. Volatile memory holds data that shutdown destroys for good: open network connections, running processes, unsaved content and — above all — the disk encryption keys. If the disk is encrypted and nobody knows the passphrase, switching the machine off amounts to destroying the evidence. This is why memory is captured first and shutdown comes afterwards.

What survives deletion

The most frequent question, and the one surrounded by the most mistaken expectations. Deleting a file, in almost every case, does not remove its contents: it tells the system that the space may be reused. Until it actually is reused, the contents are still there.

The medium, however, changes the prognosis entirely. On a traditional mechanical disk recovery is often possible even long afterwards. On a solid-state drive — that is, on almost every laptop of the last decade — a function clears freed blocks on its own initiative and quickly, in order to maintain performance: recovery becomes uncertain and in many cases impossible, without anyone having done anything to prevent it.

In both scenarios the heaviest variable is not technical but practical: a machine that keeps being used overwrites itself. A computer holding something relevant must be set aside now, not «as soon as convenient». Further reading: recovering deleted data and messages, what is genuinely possible →

Disk encryption

Recent operating systems encrypt the disk by default, often without the user having consciously chosen it. Without the passphrase, or without the recovery key held in the user's account or in the corporate domain, the contents are indistinguishable from noise, and no tool changes that fact. It is worth checking at the outset, because it establishes within minutes whether the examination is feasible at all — and avoids building a defence on an examination that cannot be carried out.

A warning about proportionality

What is needed to start

What is needed is to know which fact must be proved and in which proceedings, which machines are involved and in what state, whether they are still in use and by whom, and whether credentials or recovery keys exist. From there it takes little time to establish whether a technical route exists. How a digital forensics examination is carried out →
Further reading: what a digital forensics report costs, and what the cost depends on →